Comment Re:what kind of bugs (Score 1) 28
But I value even a 1 line change that clears a static analysis warning if even in practice it was impossible to trigger the issue in a real system.
Yes, I agree. The problem with thinking "this bug seems harmless, because I can't imagine how anyone could exploit it" is in the "I can't imagine" part; my imagination is limited to what is covered by my mental model of how computers work, but an attackers' ingenuity is not.
In particular, the C/C++ optimizer is a devious beast, and will exploit any opportunity to make the code more efficient, even if that means doing things that are wildly unintuitive to a naive human reader -- and it sees any instance of undefined behavior as an opportunity to exploit.